eclipselink icon indicating copy to clipboard operation
eclipselink copied to clipboard

Slow startup because of low entropy for PRNG

Open ago1024 opened this issue 1 year ago • 0 comments

Describe the bug

b3607a78aae5e1a4c8824baeaa6e0e348965bffd changed JCEEncryptor to use SecureRandom.getInstanceStrong(). In OpenJDK on Unix systems this is NativePRNG.Blocking which will stall if the kernel does not provide enough entropy.

We've noticed this behaviour on our CI systems where EclipseLink 2.714 startup would stall the tests.

   java.lang.Thread.State: RUNNABLE
        at java.io.FileInputStream.readBytes([email protected]/Native Method)
        at java.io.FileInputStream.read([email protected]/FileInputStream.java:279)
        at java.io.FilterInputStream.read([email protected]/FilterInputStream.java:133)
        at sun.security.provider.NativePRNG$RandomIO.readFully([email protected]/NativePRNG.java:424)
        at sun.security.provider.NativePRNG$RandomIO.ensureBufferValid([email protected]/NativePRNG.java:526)
        at sun.security.provider.NativePRNG$RandomIO.implNextBytes([email protected]/NativePRNG.java:545)
        - locked <0x00000000fcca7318> (a java.lang.Object)
        at sun.security.provider.NativePRNG$Blocking.engineNextBytes([email protected]/NativePRNG.java:268)
        at java.security.SecureRandom.nextBytes([email protected]/SecureRandom.java:751)
        at org.eclipse.persistence.internal.security.JCEEncryptor$Synergizer.getIvGCM(JCEEncryptor.java:243)
        at org.eclipse.persistence.internal.security.JCEEncryptor$Synergizer.access$4(JCEEncryptor.java:235)
        at org.eclipse.persistence.internal.security.JCEEncryptor.encryptPassword(JCEEncryptor.java:102)
        - locked <0x00000000ff7ea7e8> (a org.eclipse.persistence.internal.security.JCEEncryptor)
        at org.eclipse.persistence.sessions.DatasourceLogin.setPassword(DatasourceLogin.java:416)
        at org.eclipse.persistence.internal.jpa.EntityManagerSetupImpl.updateLogins(EntityManagerSetupImpl.java:2483)
        at org.eclipse.persistence.internal.jpa.EntityManagerSetupImpl.updateSession(EntityManagerSetupImpl.java:2806)
        at org.eclipse.persistence.internal.jpa.EntityManagerSetupImpl.deploy(EntityManagerSetupImpl.java:751)
        at org.eclipse.persistence.internal.jpa.EntityManagerFactoryDelegate.getAbstractSession(EntityManagerFactoryDelegate.java:222)
        - locked <0x00000000fcd757a8> (a org.eclipse.persistence.internal.jpa.EntityManagerFactoryDelegate)
        at org.eclipse.persistence.internal.jpa.EntityManagerFactoryDelegate.createEntityManagerImpl(EntityManagerFactoryDelegate.java:330)
        at org.eclipse.persistence.internal.jpa.EntityManagerFactoryImpl.createEntityManagerImpl(EntityManagerFactoryImpl.java:350)
        at org.eclipse.persistence.internal.jpa.EntityManagerFactoryImpl.createEntityManager(EntityManagerFactoryImpl.java:313)

To Reproduce Steps/resources to reproduce the behavior:

  • EclipseLink version 2.7.14
  • Java/JDK version JDK8/11/17/21

Expected behavior The codepath should use the nonblocking PRNG to avoid a blocked startup because of low entropy.

ago1024 avatar Feb 25 '24 18:02 ago1024